Ideas & Trends; The Spies' Code And How It Broke

By George Johnson

Published: July 16, 1995

TO the human brain, with its insatiable hunger for order, nothing is more disorienting than randomness. Soviet cryptographers knew this well when they set out to devise a code for communicating with the spy ring that included Julius and Ethel Rosenberg. With a system as simple as it was ingenious, they tried to insure that any message intercepted by United States intelligence agents would seem as meaningless as the snow on a television set tuned to an empty station.

But pure, unadulterated randomness can be extremely difficult to manufacture. As was revealed last week after decades of secrecy, in a ceremony at the Central Intelligence Agency headquarters, the Russians suffered from a lapse in quality control. They inadvertently let some pattern find its way into their scrambled codes, a loose thread that allowed American code breakers to unravel the scheme slowly.

The fine details of the Soviet encryption remain among the secrets of the National Security Agency, America's premier decoding service. But the principle behind the system, called a "one-time pad," has been known to cryptologists for years.

One begins with an alphabetical list of words or phrases likely to be needed in messages. These are numbered sequentially. Suppose that "Antenna," an early code name for Julius Rosenberg (later changed to "Liberal"), was assigned the number 2222. If the next item on the list was "anti-tank," it would be 2223, and "Anton," the code name for the Rosenbergs' K.G.B. handler, Leonid Kvasnikov, would be 2224. In such a system, a message can be converted into a sequence of numbers and decoded by anyone with a copy of the translation table.

Names not on the list could be spelled out. A code number -- 9953, say -- would tell the recipient that the following numbers stood for individual letters encrypted according to some agreed-upon scheme. Then 9954 could be a signal to stop spelling and pop back up to the dominant system in which whole words or phrases are assigned numbers.

If that is all there were to the code, even someone without the table might be able to crack it. One might profitably assume that the most frequent pattern of numbers probably represented the period or full stop. Articles like "a" and "the" would be among the next most common patterns. In many languages, the next pattern after a period would probably be a noun. With some lucky guesses, sophisticated statistical analysis and a lot of trial and error, meaning could be squeezed from the noise.

Code Upon Code

Hoping to guard against this possibility, the Russian cryptographers added another layer of obfuscation. After using the table to translate the message into a string of digits, they disguised it further by adding to it a long random number. The result would also be a random number, patternless and theoretically indecipherable.

The message would be decodable by the Russians because sender and receiver each knew the random number used in the encoding scheme. If the sender wanted to encrypt "Antenna," he would translate it into 2222, then take out a pad imprinted with the random number key and copy down the first four digits, perhaps 3913. Adding the two numbers would produce 6135. Then he would move onto the next part of the message, adding it to the next digits on the pad. Once they had been used, the random numbers would be discarded -- hence the name "one-time pad."

To decode the message, the recipient would take out his random number pad, copy the appropriate digits and subtract them from the message to recover the original number string. Proceeding like this, always carefully keeping their place on the pad, sender and receiver would be able to read dispatches that to anyone intercepting them would look like pure noise. While "Antenna" might be 3913 in one sentence, in the next it might be 4710. Since there is no structure to the key, there are none of the patterns cryptanalysts need to get a statistical foothold.

"Given a pure, perfect one-time system, you're not going to break it," said David Kahn, visiting historian at the N.S.A.'s Center for Cryptologic History and author of "The Codebreakers" (Macmillan, 1967). Even if the message were short enough for an intelligence agent to systematically subtract from it every possible number string, the result would be meaningless. "You would simply find that you had generated every possible message in every possible language with no way of telling which one was correct," Mr. Kahn said.

But no system is foolproof. First, generating a truly random number is harder than it sounds. Flipping a coin produces a random pattern containing an equal number of heads and tails -- but only if the coin is perfectly balanced. More likely, differences in the engravings could make one side heavier than the other. The result would be deviations from randomness that might allow an observer to tell from the record of a coin toss whether it was more likely generated by a nickel or a dime. Similarly, if the code sender's random number generator is flawed, there might be enough order in the message for cryptanalysts to reconstruct the key.

Asking for Infinity

As revealed by American cryptologists last week, the Russians' crucial flaw was much more trivial. The problem with the one-time pad is that it depends on generating a number that is, as Mr. Kahn put it, not only absolutely random but endless. In practice, the number cannot be infinite, of course, but it must be long enough to encode every possible message that will conceivably be sent over a channel.

As traffic between Moscow and the K.G.B. office in New York increased in volume, the Russians apparently ran out of numbers and committed the cryptographer's cardinal sin. They repeated themselves, betraying details of Soviet espionage efforts on American soil. The spell of randomness was broken, and meaning began seeping in.

Chart: "Making The Code" Last week the National Security Agency released some details of a Soviet cryptological system that U.S. intelligence agents broke beginning in 1944.